create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/routes/content/pricing.ts

@@ -1,176 +0,0 @@
-/**
- * GET /v1/content/pricing
- *
- * The site's pricing tiers, read from a `Product` page's `offers` (#7178).
- * The HTTP twin of the `get_pricing` MCP tool: same arguments, parsed with
- * the same `@working-theory/validation` schema, and the same result, produced
- * by the same function — `getPricingTiers` in `@working-theory/content-adapters`,
- * the shared seam the tool also answers through. That is the API ↔ MCP parity
- * contract in the root CLAUDE.md; the parity guard's `get_pricing` row is a
- * `twin` naming this route.
- *
- * Query:
- *   slug    optional — lowercase alphanumeric and hyphens; default `pricing`
- *   locale  optional — BCP-47 (`xx` or `xx-XX`). A well-formed tag outside the
- *           project's allowlist silently falls back to the default locale
- *           (AC-i18n-07), matching every other content read; a malformed one
- *           is a 400, as the tool refuses it.
- *
- * Success: `{ ok: true, data: { tiers } | null }` — the API's documented
- * envelope, not the JSON-LD `ItemList` the older content routes answer. "No
- * pricing" is a 200 with `data: null`, exactly as the tool answers it.
- * Refusals: `400 validation_failed` (issues are not echoed), `404 not_found`
- * when no public site resolves, `500 internal_error`.
- *
- * Registered BEFORE `/v1/content/:type` in `index.ts`. Fastify's radix router
- * prefers a static segment over a parametric one regardless of order — the
- * ordering is belt-and-braces, as it is for search. `/v1/content/Pricing`
- * (the page type, capitalised) stays the type list.
- *
- * Rate limiting is inherited: `server.ts` registers the limiter GLOBALLY with
- * the content ceiling, so this route is covered without one of its own.
- *
- * Which site this read serves is resolved BEFORE any content query (#5852)
- * through the same `resolvePublicContentAdapter(request)` seam the sibling
- * content reads use. The resolver reads `x-ailk-spoke-key`, so every answer
- * past the query parse appends that header to `Vary`: a cache keyed on the
- * URL alone must never share one site's answer — or one bad key's 404 — with
- * another. It appends rather than sets, because `@fastify/cors` has already
- * written `Vary: Origin`.
- *
- * Offerings (#8933, spec D4): on a connected workspace with a current shown
- * set, the `pricing` page (the default slug) answers that set instead — one
- * tier per Stripe Price, through `readShownOfferings` (#8924's read, the one
- * code path every agent surface shares) and `pricingTiersFromShownSet` in
- * `@working-theory/content-adapters`, the mapping the tool answers through
- * too. Each tier then also carries `interval` and the full `lookupKey`. Every
- * other slug, and every workspace with no connection, no claim or no current
- * set, answers page content exactly as before; a failed shown-set read takes
- * the content path too. The read refreshes, or not, exactly as the
- * shown-offerings route does (`options`, D5): never with the owner's
- * override, never per request (T7).
- *
- * Anonymous and identity-blind: no `Authorization`, cookie, session or user
- * id is read.
- */
-import {
-  currentShownSet,
-  getPricingTiers,
-  pricingTiersFromShownSet,
-  shownSetAnswersPricing,
-} from "@working-theory/content-adapters";
-import {
-  getPricingInputSchema,
-  type GetPricingOutput,
-} from "@working-theory/validation";
-import type {
-  FastifyPluginAsync,
-  FastifyReply,
-  FastifyRequest,
-} from "fastify";
-
-import { resolveLocale } from "../../lib/locales.js";
-import { resolvePublicContentAdapter } from "../../services/public-site-resolver.js";
-
-import {
-  readShownOfferings,
-  type ShownOfferingsRouteOptions,
-} from "./shown-offerings.js";
-
-/** The request header the resolver picks the site's workspace from. */
-const SPOKE_KEY_HEADER = "x-ailk-spoke-key";
-
-/** Adds the spoke-key header to `Vary`, keeping every value already there. */
-function varyOnSpokeKey(reply: FastifyReply): void {
-  const existing = reply.getHeader("vary");
-  const values = (
-    Array.isArray(existing) ? existing.join(",") : String(existing ?? "")
-  )
-    .split(",")
-    .map((value) => value.trim())
-    .filter((value) => value !== "");
-  if (!values.some((value) => value.toLowerCase() === SPOKE_KEY_HEADER)) {
-    values.push(SPOKE_KEY_HEADER);
-  }
-  reply.header("Vary", values.join(", "));
-}
-
-/** An error's class name only — never its message, which may carry Stripe text. */
-function errName(err: unknown): string {
-  return err instanceof Error ? err.constructor.name : typeof err;
-}
-
-/**
- * The connected workspace's shown set as tiers, or `null` for the content
- * path (#8933 D4). A failed read or mapping is one fixed `warn` line and the
- * content path, never a 500 and never an `{ err }` line.
- */
-async function shownSetTiers(
-  request: FastifyRequest,
-  options: ShownOfferingsRouteOptions,
-): Promise<NonNullable<GetPricingOutput> | null> {
-  try {
-    const shownSet = currentShownSet(
-      await readShownOfferings(request, options),
-    );
-    return shownSet === null ? null : pricingTiersFromShownSet(shownSet);
-  } catch (err) {
-    request.log.warn(
-      { outcome: "shown_set_failed", errName: errName(err) },
-      "[Content] pricing: shown set unavailable, answering page content",
-    );
-    return null;
-  }
-}
-
-export const pricingRoute: FastifyPluginAsync<
-  ShownOfferingsRouteOptions
-> = async (fastify, options) => {
-  fastify.get<{
-    Querystring: { slug?: string; locale?: string };
-  }>("/v1/content/pricing", async (request, reply) => {
-    const query = getPricingInputSchema.safeParse(request.query);
-    if (!query.success) {
-      return reply.status(400).send({
-        ok: false,
-        error: {
-          code: "validation_failed",
-          message: "Invalid query parameters",
-        },
-      });
-    }
-
-    const locale = resolveLocale(query.data.locale);
-    // Every answer from here on depends on the spoke key — the 404 and 500
-    // included — so each carries the Vary.
-    varyOnSpokeKey(reply);
-
-    try {
-      const adapter = await resolvePublicContentAdapter(request);
-      if (adapter === null) {
-        return reply.status(404).send({
-          ok: false,
-          error: { code: "not_found", message: "Page not found" },
-        });
-      }
-
-      if (shownSetAnswersPricing(query.data.slug)) {
-        const tiers = await shownSetTiers(request, options);
-        if (tiers !== null) return reply.send({ ok: true, data: tiers });
-      }
-
-      const data = await getPricingTiers(adapter, {
-        slug: query.data.slug,
-        locale,
-      });
-
-      return reply.send({ ok: true, data });
-    } catch (error) {
-      request.log.error({ err: error }, "[Content] getPricingTiers failed");
-      return reply.status(500).send({
-        ok: false,
-        error: { code: "internal_error", message: "Internal server error" },
-      });
-    }
-  });
-};

package/templates/apps/api/src/routes/content/rate-limit.ts

@@ -1,22 +0,0 @@
-/**
- * Rate-limit configuration for the public content API.
- *
- * `CONTENT_RATE_LIMIT_UNAUTH` (60 req/min/IP) is the GLOBAL ceiling
- * `server.ts` registers — agents reading the public API generally don't
- * authenticate.
- *
- * `CONTENT_RATE_LIMIT_AUTH` (600 req/min) is the SCOPE-LOCAL ceiling raised on
- * the tenant-guarded content-write scope (#5853 D12,
- * `routes/workspaces/content.ts`), which is the first scope in this app with an
- * authenticated identity to hang it on. Sixty saves a minute is below what a
- * real editing session generates, so an autosaving editor under the global
- * ceiling would rate-limit its own user.
- *
- * Both limiters are in-memory and per-process (`server.ts`'s own comment), so
- * neither is keyed on the tenant: a per-workspace key would be a fiction on a
- * multi-instance deployment. The store swap is the change that makes one
- * possible.
- */
-export const CONTENT_RATE_LIMIT_UNAUTH = 60;
-export const CONTENT_RATE_LIMIT_AUTH = 600;
-export const CONTENT_RATE_LIMIT_WINDOW = "1 minute";

package/templates/apps/api/src/routes/content/search.ts

@@ -1,129 +0,0 @@
-/**
- * GET /v1/content/search
- *
- * Keyword search across published pages (#5831), scored by the adapter on
- * title / description / body. The HTTP twin of the `search_content` MCP tool:
- * same arguments, same adapter call, same result set — which is the API ↔ MCP
- * parity contract in the root CLAUDE.md. Until this route existed the parity
- * was one-sided, the tool having no endpoint to map to.
- *
- * Query:
- *   q        required, 1..200 chars — the search string. The ceiling matches
- *            the `search_content` MCP tool's own cap (`searchContentInputSchema`)
- *            so the pair rejects the same inputs, and bounds the work an
- *            unauthenticated caller can ask of the scorer per request.
- *   type     optional — a schema.org page type
- *   category optional — a LEAF slug from the site-category registry. Outside
- *            the registry is a 400, not an empty result: the registry is
- *            closed, so a bad slug is a caller mistake worth surfacing.
- *   limit    optional, 1..50, default 10
- *   locale   optional — BCP-47; invalid or unknown values silently fall back
- *            to the project's default locale (AC-i18n-07), matching every
- *            other content read.
- *
- * Registered BEFORE `/v1/content/:type` in `index.ts`. Fastify's radix router
- * prefers a static segment over a parametric one regardless of order — the
- * ordering is belt-and-braces, and `/v1/content/types` is the same shape that
- * already proves it.
- *
- * The response is an `ItemList` JSON-LD document. `items` is the adapter's own
- * `SearchResult[]`, unreshaped: a caller comparing this route against the MCP
- * tool must see the same objects, and a projection here would be the place
- * they silently diverged.
- *
- * Rate limiting is inherited: `server.ts` registers the limiter GLOBALLY with
- * the content ceiling (`rate-limit.ts`'s `CONTENT_RATE_LIMIT_UNAUTH` /
- * `_WINDOW`), so this route is covered without registering one of its own.
- *
- * Which site this read serves is resolved BEFORE any content query (#5852,
- * #5910), through the SAME `resolvePublicContentAdapter(request)` seam
- * `get-page.ts` and `list-pages.ts` already use — not the bare
- * `getContentAdapter()` this route called until #5910, which threw under
- * `CONTENT_ADAPTER=database` (no `workspaceId`) and answered every request
- * with a 500. An unresolved site 404s rather than an empty `ItemList` — each
- * route keeps its own 404 shape (D8), but shares the SAME `error: "Page not
- * found"` string a missing/foreign slug gets elsewhere: a resolution failure
- * carries no detail an unauthenticated caller could use to tell it apart
- * from "nothing matched" (AC-WCE-05).
- */
-import {
-  SCHEMA_ORG_TYPES,
-  type SearchOptions,
-} from "@working-theory/content-adapters";
-import { CategorySlugSchema } from "@working-theory/schema/categories";
-import type { FastifyPluginAsync } from "fastify";
-import { z } from "zod";
-
-import { resolveLocale } from "../../lib/locales.js";
-import { resolvePublicContentAdapter } from "../../services/public-site-resolver.js";
-
-const LIMIT_MAX = 50;
-const LIMIT_DEFAULT = 10;
-/** Mirrors `searchContentInputSchema`'s `query` cap — the pair rejects alike. */
-const QUERY_MAX = 200;
-
-const querySchema = z.object({
-  q: z.string().min(1).max(QUERY_MAX),
-  type: z.enum(SCHEMA_ORG_TYPES).optional(),
-  category: CategorySlugSchema.optional(),
-  limit: z.coerce.number().int().min(1).max(LIMIT_MAX).default(LIMIT_DEFAULT),
-  locale: z.string().optional(),
-});
-
-export const searchContentRoute: FastifyPluginAsync = async (fastify) => {
-  fastify.get<{
-    Querystring: {
-      q?: string;
-      type?: string;
-      category?: string;
-      limit?: string;
-      locale?: string;
-    };
-  }>("/v1/content/search", async (request, reply) => {
-    const query = querySchema.safeParse(request.query);
-    if (!query.success) {
-      return reply.status(400).send({
-        error: "Invalid query parameters",
-        details: query.error.issues,
-      });
-    }
-
-    const { q, type, category, limit } = query.data;
-    const locale = resolveLocale(query.data.locale);
-
-    const options: SearchOptions = {
-      limit,
-      ...(type !== undefined && { type }),
-      ...(category !== undefined && { category }),
-      locale,
-    };
-
-    try {
-      // Site resolution precedes any content query (#5852, #5910). A refusal
-      // is a 404 sharing the same "Page not found" error string a
-      // missing/foreign slug gets on the other content routes (each keeps
-      // its own body shape — D8), not an empty `ItemList`: a 200 with zero
-      // items would assert that this site exists and simply matched
-      // nothing, which is false when no site resolved.
-      const adapter = await resolvePublicContentAdapter(request);
-      if (adapter === null) {
-        return reply.status(404).send({
-          error: "Page not found",
-        });
-      }
-
-      const items = await adapter.searchPages(q, options);
-
-      return reply.send({
-        "@context": "https://schema.org",
-        "@type": "ItemList",
-        query: q,
-        items,
-        totalItems: items.length,
-      });
-    } catch (error) {
-      request.log.error({ err: error }, "[Content] searchPages failed");
-      return reply.status(500).send({ error: "Internal server error" });
-    }
-  });
-};

package/templates/apps/api/src/routes/content/shown-offerings.ts

@@ -1,229 +0,0 @@
-/**
- * GET /v1/content/shown-offerings
- *
- * The `/pricing` page's Offerings read (#8924, spec
- * docs/specs/8924-the-anonymous-pricing-read-the-spec.md): the resolved
- * workspace's shown set, read from its persisted Stripe snapshot through
- * #8876's `getWorkspaceShownSet`. No argument — no path parameter, query or
- * body, and a query string is ignored.
- *
- * Answers (D2), each in the `{ ok, data }` envelope, never a JSON-LD root:
- *   `{ status: "shown", shownSet }` — a resolved, connected workspace with
- *       the `commerce` claim. `shownSet` is the service's parsed result less
- *       `workspaceId` and `organizationId`: `productIds`, `recommended`,
- *       `offerings`, `state` and `snapshotAt`, as the service answered them.
- *   `{ status: "unconnected" }` — render the page content as today: the
- *       content adapter is not `database` (the resolver's `not-required`),
- *       the licence lacks the claim, or the workspace has no connection or
- *       no `WorkspaceOfferings` row.
- *   `{ status: "empty" }` — fail closed, show no prices at all: the resolver
- *       answered `unresolved` (a refused spoke key, an ambiguous or unmatched
- *       host), or the licence is configured but cannot be read.
- *   `500 internal_error` — the resolver, the claim read or the first read
- *       threw. A refresh never turns an answer into a 500.
- *
- * T7 — an anonymous read never reaches Stripe per request (D6). A snapshot
- * that is not `current`, or is at least `SHOWN_OFFERINGS_REFRESH_AFTER_MS`
- * old, triggers `refreshWorkspaceSnapshot` on its bounded path only: the
- * service joins the Organization's read in flight, reuses a read under a
- * minute old and holds a failed one for a minute. This route never passes
- * the owner's override, keeps no state of its own, and waits at most
- * `SHOWN_OFFERINGS_REFRESH_BUDGET_MS`; a refresh that fails, stalls or
- * throws leaves the first read served. `server.ts` registers it with the
- * Organization's Stripe catalog source (#8922, #9124); registered with no
- * `sourceFor` (D7) it serves the persisted snapshot and never refreshes.
- *
- * The workspace comes only from `resolvePublicWorkspace(request)`, whose one
- * request input is a hub spoke's `x-ailk-spoke-key`; so every answer, the
- * 500 included, appends that header to `Vary`. No `Cache-Control` is set.
- * The claim is read in the handler, not by the `requireCommerceClaim`
- * preHandler, so a refused spoke key answers `empty` rather than a 404 (D4),
- * and the services are imported only after it reads `claimed` (D5).
- *
- * T6 — a log line carries only the resolver's `reason`, a fixed `outcome`,
- * `workspaceId` and an error's class name: never a product or price id, a
- * name, any Stripe text or an error message (D9).
- *
- * Rate limiting is inherited from the server's global content ceiling. No
- * MCP twin, by decision (`tests/parity/README.md`, D8): agents read offerings
- * through `get_pricing` and `get_offerings`, whose HTTP twins answer through
- * this file's `readShownOfferings` (#8933 D1) — the one read of the snapshot
- * every agent surface shares.
- *
- * Anonymous and identity-blind: no `Authorization`, cookie, session or user
- * id is read.
- */
-import type { ShownOfferingsAnswer } from "@working-theory/validation";
-import type {
-  FastifyPluginAsync,
-  FastifyReply,
-  FastifyRequest,
-} from "fastify";
-
-import { resolveCommerceClaim } from "../../lib/require-commerce-claim.js";
-import type { OfferingsSourceFor } from "../../services/offerings/index.js";
-import { resolvePublicWorkspace } from "../../services/public-site-resolver.js";
-
-/** A snapshot at least this old is refreshed, on the service's own bound. */
-export const SHOWN_OFFERINGS_REFRESH_AFTER_MS = 60_000;
-/** The longest one request waits on a refresh before serving its first read. */
-export const SHOWN_OFFERINGS_REFRESH_BUDGET_MS = 3000;
-
-export interface ShownOfferingsRouteOptions {
-  /** The Stripe-backed catalog source; without it the route never refreshes. */
-  sourceFor?: OfferingsSourceFor;
-  now?: () => Date;
-}
-
-/** The request header the resolver picks the site's workspace from. */
-const SPOKE_KEY_HEADER = "x-ailk-spoke-key";
-
-/** Adds the spoke-key header to `Vary`, keeping every value already there. */
-function varyOnSpokeKey(reply: FastifyReply): void {
-  const existing = reply.getHeader("vary");
-  const values = (
-    Array.isArray(existing) ? existing.join(",") : String(existing ?? "")
-  )
-    .split(",")
-    .map((value) => value.trim())
-    .filter((value) => value !== "");
-  if (!values.some((value) => value.toLowerCase() === SPOKE_KEY_HEADER)) {
-    values.push(SPOKE_KEY_HEADER);
-  }
-  reply.header("Vary", values.join(", "));
-}
-
-/** An error's class name only — never its message, which may carry Stripe text. */
-function errName(err: unknown): string {
-  return err instanceof Error ? err.constructor.name : typeof err;
-}
-
-const OVER_BUDGET = Symbol("over-budget");
-
-/**
- * The read itself (#8933 D1), shared by this route and the two agent twins
- * (`GET /v1/content/pricing` and `GET /v1/content/offerings`): the
- * resolver's arms, the claim gate, the late import and the bounded refresh,
- * answering one of the three answers. It sets no header and writes no reply;
- * a resolver, claim or first-read error rejects. Its log lines go through
- * `request.log`, so a twin's request emits them too.
- */
-export async function readShownOfferings(
-  request: FastifyRequest,
-  { sourceFor, now: clock = () => new Date() }: ShownOfferingsRouteOptions,
-): Promise<ShownOfferingsAnswer> {
-  const now = clock();
-
-  const resolution = await resolvePublicWorkspace(request);
-  if (resolution.kind === "unresolved") {
-    request.log.warn(
-      { reason: resolution.reason },
-      "[content] shown-offerings: workspace unresolved",
-    );
-    return { status: "empty" };
-  }
-  if (resolution.kind === "not-required") {
-    return { status: "unconnected" };
-  }
-
-  const claim = await resolveCommerceClaim();
-  if (claim === "unclaimed") {
-    return { status: "unconnected" };
-  }
-  if (claim === "undetermined") {
-    request.log.warn(
-      { outcome: "license_undetermined" },
-      "[content] shown-offerings: licence unreadable",
-    );
-    return { status: "empty" };
-  }
-
-  const { workspaceId } = resolution;
-  const { getWorkspaceShownSet, refreshWorkspaceSnapshot } =
-    await import("../../services/offerings/index.js");
-  let shown = await getWorkspaceShownSet(workspaceId, { now });
-  if (shown === null) {
-    return { status: "unconnected" };
-  }
-
-  const stale =
-    shown.state !== "current" ||
-    shown.snapshotAt === null ||
-    now.getTime() - Date.parse(shown.snapshotAt) >=
-      SHOWN_OFFERINGS_REFRESH_AFTER_MS;
-  if (sourceFor && stale) {
-    // Caught before the race, so a rejection after the budget is logged
-    // the same way and is never unhandled.
-    const refresh = refreshWorkspaceSnapshot(workspaceId, sourceFor, {
-      now,
-    }).catch((err: unknown) => {
-      request.log.warn(
-        { workspaceId, outcome: "refresh_failed", errName: errName(err) },
-        "[content] shown-offerings: refresh failed",
-      );
-      return null;
-    });
-    let timer: NodeJS.Timeout | undefined;
-    const budget = new Promise<typeof OVER_BUDGET>((resolve) => {
-      timer = setTimeout(
-        () => resolve(OVER_BUDGET),
-        SHOWN_OFFERINGS_REFRESH_BUDGET_MS,
-      );
-    });
-    let outcome: Awaited<typeof refresh> | typeof OVER_BUDGET;
-    try {
-      outcome = await Promise.race([refresh, budget]);
-    } finally {
-      clearTimeout(timer);
-    }
-
-    if (outcome === OVER_BUDGET) {
-      request.log.warn(
-        { workspaceId, outcome: "refresh_over_budget" },
-        "[content] shown-offerings: refresh over budget",
-      );
-    } else if (outcome === "refreshed") {
-      try {
-        const reread = await getWorkspaceShownSet(workspaceId, { now });
-        if (reread === null) {
-          return { status: "unconnected" };
-        }
-        shown = reread;
-      } catch (err) {
-        request.log.warn(
-          { workspaceId, outcome: "reread_failed", errName: errName(err) },
-          "[content] shown-offerings: re-read failed",
-        );
-      }
-    }
-  }
-
-  const {
-    workspaceId: _workspaceId,
-    organizationId: _organizationId,
-    ...shownSet
-  } = shown;
-  return { status: "shown", shownSet };
-}
-
-export const shownOfferingsRoute: FastifyPluginAsync<
-  ShownOfferingsRouteOptions
-> = async (fastify, options) => {
-  fastify.get("/v1/content/shown-offerings", async (request, reply) => {
-    varyOnSpokeKey(reply);
-
-    try {
-      const data = await readShownOfferings(request, options);
-      return reply.send({ ok: true, data });
-    } catch (err) {
-      request.log.error(
-        { errName: errName(err) },
-        "[content] shown-offerings read failed",
-      );
-      return reply.status(500).send({
-        ok: false,
-        error: { code: "internal_error", message: "Internal server error" },
-      });
-    }
-  });
-};

package/templates/apps/api/src/routes/content/slug.ts

@@ -1,9 +0,0 @@
-/**
- * Slug allowlist for D14a content-write routes.
- *
- * Re-exported from `@working-theory/content-adapters` (single source of truth, per
- * issue #398). The adapter sanitizes slug + type before any path
- * construction or git argument; this regex is the route-layer fail-fast
- * mirror so malformed input gets a 400 before reaching the adapter.
- */
-export { SLUG_PATTERN } from "@working-theory/content-adapters";

package/templates/apps/api/src/routes/leads/__tests__/capture.test.ts

@@ -1,88 +0,0 @@
-/**
- * @file capture.test.ts
- * `GET /v1/leads/capture` (#6730 D4) — the four D1 environments, and the
- * body's exact shape: two booleans, never the mode or an env name.
- */
-
-import type { FastifyInstance } from "fastify";
-
-// The route module also carries the write routes; their dependencies are
-// external boundaries this read never reaches.
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts is the repo-standard double
-jest.mock("../../../lib/prisma.js");
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn(),
-  sendRequestConfirmEmail: jest.fn(),
-  sendRequestPaidLinkEmail: jest.fn(),
-}));
-
-import { leadCaptureStatusRoute } from "../index";
-
-const ENV_KEYS = [
-  "DATABASE_URL",
-  "NODE_ENV",
-  "RESEND_API_KEY",
-  "AILK_LEAD_NOTIFICATION_TO",
-  "AILK_LEAD_NOTIFICATION_FROM",
-  "LEAD_CAPTURE_FILE_DISABLED",
-] as const;
-
-const EMAIL_ENV = {
-  RESEND_API_KEY: "re_test",
-  AILK_LEAD_NOTIFICATION_TO: "owner@example.com",
-  AILK_LEAD_NOTIFICATION_FROM: "noreply@example.com",
-};
-
-describe("GET /v1/leads/capture", () => {
-  let app: FastifyInstance;
-  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
-
-  beforeEach(async () => {
-    saved = {};
-    for (const k of ENV_KEYS) saved[k] = process.env[k];
-    for (const k of ENV_KEYS) delete process.env[k];
-    const fastify = require("fastify")();
-    await fastify.register(leadCaptureStatusRoute);
-    app = fastify;
-  });
-
-  afterEach(async () => {
-    await app.close();
-    for (const k of ENV_KEYS) {
-      if (saved[k] === undefined) delete process.env[k];
-      else process.env[k] = saved[k];
-    }
-  });
-
-  const get = () => app.inject({ method: "GET", url: "/v1/leads/capture" });
-
-  it.each([
-    ["inbox", { DATABASE_URL: "postgres://x", NODE_ENV: "production" }, true, true],
-    ["email", { ...EMAIL_ENV, NODE_ENV: "production" }, true, false],
-    ["local", { NODE_ENV: "development" }, true, true],
-    ["none", { NODE_ENV: "production" }, false, false],
-  ] as const)("%s → contact=%s newsletter=%s", async (_mode, env, contact, newsletter) => {
-    Object.assign(process.env, env);
-
-    const res = await get();
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({ ok: true, data: { contact, newsletter } });
-  });
-
-  it("the body carries exactly ok + data{contact,newsletter} — no mode, no env names", async () => {
-    Object.assign(process.env, EMAIL_ENV, { NODE_ENV: "production" });
-
-    const res = await get();
-    const body = res.json();
-
-    expect(Object.keys(body).sort()).toEqual(["data", "ok"]);
-    expect(Object.keys(body.data).sort()).toEqual(["contact", "newsletter"]);
-    expect(res.body).not.toMatch(/email|inbox|RESEND|DATABASE|owner@example\.com/);
-  });
-
-  it("is cacheable for a minute", async () => {
-    const res = await get();
-    expect(res.headers["cache-control"]).toBe("public, max-age=60");
-  });
-});